1IPTABLES(8) iptables 1.8.5 IPTABLES(8)
2
6 iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering
7 and NAT
8
10 iptables [-t table] {-A|-C|-D} chain rule-specification
11 ip6tables [-t table] {-A|-C|-D} chain rule-specification
13 iptables [-t table] -I chain [rulenum] rule-specification
15 iptables [-t table] -R chain rulenum rule-specification
17 iptables [-t table] -D chain rulenum
19 iptables [-t table] -S [chain [rulenum]]
21 iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]
23 iptables [-t table] -N chain
25 iptables [-t table] -X [chain]
27 iptables [-t table] -P chain target
29 iptables [-t table] -E old-chain-name new-chain-name
31 rule-specification = [matches...] [target]
33 match = -m matchname [per-match-options]
35 target = -j targetname [per-target-options]
37
39 Iptables and ip6tables are used to set up, maintain, and inspect the
40 tables of IPv4 and IPv6 packet filter rules in the Linux kernel. Sev‐
41 eral different tables may be defined. Each table contains a number of
42 built-in chains and may also contain user-defined chains.
43 Each chain is a list of rules which can match a set of packets. Each
45 rule specifies what to do with a packet that matches. This is called a
46 `target', which may be a jump to a user-defined chain in the same ta‐
47 ble.
48
50 A firewall rule specifies criteria for a packet and a target. If the
51 packet does not match, the next rule in the chain is examined; if it
52 does match, then the next rule is specified by the value of the target,
53 which can be the name of a user-defined chain, one of the targets
54 described in iptables-extensions(8), or one of the special values
55 ACCEPT, DROP or RETURN.
56 ACCEPT means to let the packet through. DROP means to drop the packet
58 on the floor. RETURN means stop traversing this chain and resume at
59 the next rule in the previous (calling) chain. If the end of a built-
60 in chain is reached or a rule in a built-in chain with target RETURN is
61 matched, the target specified by the chain policy determines the fate
62 of the packet.
63
65 There are currently five independent tables (which tables are present
66 at any time depends on the kernel configuration options and which mod‐
67 ules are present).
68 -t, --table table
70 This option specifies the packet matching table which the com‐
71 mand should operate on. If the kernel is configured with auto‐
72 matic module loading, an attempt will be made to load the appro‐
73 priate module for that table if it is not already there.
74 The tables are as follows:
76 filter:
78 This is the default table (if no -t option is passed). It
79 contains the built-in chains INPUT (for packets destined to
80 local sockets), FORWARD (for packets being routed through
81 the box), and OUTPUT (for locally-generated packets).
82 nat:
84 This table is consulted when a packet that creates a new
85 connection is encountered. It consists of four built-ins:
86 PREROUTING (for altering packets as soon as they come in),
87 INPUT (for altering packets destined for local sockets),
88 OUTPUT (for altering locally-generated packets before rout‐
89 ing), and POSTROUTING (for altering packets as they are
90 about to go out). IPv6 NAT support is available since ker‐
91 nel 3.7.
92 mangle:
94 This table is used for specialized packet alteration. Until
95 kernel 2.4.17 it had two built-in chains: PREROUTING (for
96 altering incoming packets before routing) and OUTPUT (for
97 altering locally-generated packets before routing). Since
98 kernel 2.4.18, three other built-in chains are also sup‐
99 ported: INPUT (for packets coming into the box itself), FOR‐
100 WARD (for altering packets being routed through the box),
101 and POSTROUTING (for altering packets as they are about to
102 go out).
103 raw:
105 This table is used mainly for configuring exemptions from
106 connection tracking in combination with the NOTRACK target.
107 It registers at the netfilter hooks with higher priority and
108 is thus called before ip_conntrack, or any other IP tables.
109 It provides the following built-in chains: PREROUTING (for
110 packets arriving via any network interface) OUTPUT (for
111 packets generated by local processes)
112 security:
114 This table is used for Mandatory Access Control (MAC) net‐
115 working rules, such as those enabled by the SECMARK and
116 CONNSECMARK targets. Mandatory Access Control is imple‐
117 mented by Linux Security Modules such as SELinux. The secu‐
118 rity table is called after the filter table, allowing any
119 Discretionary Access Control (DAC) rules in the filter table
120 to take effect before MAC rules. This table provides the
121 following built-in chains: INPUT (for packets coming into
122 the box itself), OUTPUT (for altering locally-generated
123 packets before routing), and FORWARD (for altering packets
124 being routed through the box).
125
127 The options that are recognized by iptables and ip6tables can be
128 divided into several different groups.
129 COMMANDS
131 These options specify the desired action to perform. Only one of them
132 can be specified on the command line unless otherwise stated below. For
133 long versions of the command and option names, you need to use only
134 enough letters to ensure that iptables can differentiate it from all
135 other options.
136 -A, --append chain rule-specification
138 Append one or more rules to the end of the selected chain. When
139 the source and/or destination names resolve to more than one
140 address, a rule will be added for each possible address combina‐
141 tion.
142 -C, --check chain rule-specification
144 Check whether a rule matching the specification does exist in
145 the selected chain. This command uses the same logic as -D to
146 find a matching entry, but does not alter the existing iptables
147 configuration and uses its exit code to indicate success or
148 failure.
149 -D, --delete chain rule-specification
151 -D, --delete chain rulenum
152 Delete one or more rules from the selected chain. There are two
153 versions of this command: the rule can be specified as a number
154 in the chain (starting at 1 for the first rule) or a rule to
155 match.
156 -I, --insert chain [rulenum] rule-specification
158 Insert one or more rules in the selected chain as the given rule
159 number. So, if the rule number is 1, the rule or rules are
160 inserted at the head of the chain. This is also the default if
161 no rule number is specified.
162 -R, --replace chain rulenum rule-specification
164 Replace a rule in the selected chain. If the source and/or des‐
165 tination names resolve to multiple addresses, the command will
166 fail. Rules are numbered starting at 1.
167 -L, --list [chain]
169 List all rules in the selected chain. If no chain is selected,
170 all chains are listed. Like every other iptables command, it
171 applies to the specified table (filter is the default), so NAT
172 rules get listed by
173 iptables -t nat -n -L
174 Please note that it is often used with the -n option, in order
175 to avoid long reverse DNS lookups. It is legal to specify the
176 -Z (zero) option as well, in which case the chain(s) will be
177 atomically listed and zeroed. The exact output is affected by
178 the other arguments given. The exact rules are suppressed until
179 you use
180 iptables -L -v
181 or iptables-save(8).
182 -S, --list-rules [chain]
184 Print all rules in the selected chain. If no chain is selected,
185 all chains are printed like iptables-save. Like every other ipt‐
186 ables command, it applies to the specified table (filter is the
187 default).
188 -F, --flush [chain]
190 Flush the selected chain (all the chains in the table if none is
191 given). This is equivalent to deleting all the rules one by
192 one.
193 -Z, --zero [chain [rulenum]]
195 Zero the packet and byte counters in all chains, or only the
196 given chain, or only the given rule in a chain. It is legal to
197 specify the -L, --list (list) option as well, to see the coun‐
198 ters immediately before they are cleared. (See above.)
199 -N, --new-chain chain
201 Create a new user-defined chain by the given name. There must
202 be no target of that name already.
203 -X, --delete-chain [chain]
205 Delete the optional user-defined chain specified. There must be
206 no references to the chain. If there are, you must delete or
207 replace the referring rules before the chain can be deleted.
208 The chain must be empty, i.e. not contain any rules. If no
209 argument is given, it will attempt to delete every non-builtin
210 chain in the table.
211 -P, --policy chain target
213 Set the policy for the built-in (non-user-defined) chain to the
214 given target. The policy target must be either ACCEPT or DROP.
215 -E, --rename-chain old-chain new-chain
217 Rename the user specified chain to the user supplied name. This
218 is cosmetic, and has no effect on the structure of the table.
219 -h Help. Give a (currently very brief) description of the command
221 syntax.
222 PARAMETERS
224 The following parameters make up a rule specification (as used in the
225 add, delete, insert, replace and append commands).
226 -4, --ipv4
228 This option has no effect in iptables and iptables-restore. If
229 a rule using the -4 option is inserted with (and only with)
230 ip6tables-restore, it will be silently ignored. Any other uses
231 will throw an error. This option allows IPv4 and IPv6 rules in a
232 single rule file for use with both iptables-restore and
233 ip6tables-restore.
234 -6, --ipv6
236 If a rule using the -6 option is inserted with (and only with)
237 iptables-restore, it will be silently ignored. Any other uses
238 will throw an error. This option allows IPv4 and IPv6 rules in a
239 single rule file for use with both iptables-restore and
240 ip6tables-restore. This option has no effect in ip6tables and
241 ip6tables-restore.
242 [!] -p, --protocol protocol
244 The protocol of the rule or of the packet to check. The speci‐
245 fied protocol can be one of tcp, udp, udplite, icmp, icmpv6,esp,
246 ah, sctp, mh or the special keyword "all", or it can be a
247 numeric value, representing one of these protocols or a differ‐
248 ent one. A protocol name from /etc/protocols is also allowed.
249 A "!" argument before the protocol inverts the test. The number
250 zero is equivalent to all. "all" will match with all protocols
251 and is taken as default when this option is omitted. Note that,
252 in ip6tables, IPv6 extension headers except esp are not allowed.
253 esp and ipv6-nonext can be used with Kernel version 2.6.11 or
254 later. The number zero is equivalent to all, which means that
255 you cannot test the protocol field for the value 0 directly. To
256 match on a HBH header, even if it were the last, you cannot use
257 -p 0, but always need -m hbh.
258 [!] -s, --source address[/mask][,...]
260 Source specification. Address can be either a network name, a
261 hostname, a network IP address (with /mask), or a plain IP
262 address. Hostnames will be resolved once only, before the rule
263 is submitted to the kernel. Please note that specifying any
264 name to be resolved with a remote query such as DNS is a really
265 bad idea. The mask can be either an ipv4 network mask (for ipt‐
266 ables) or a plain number, specifying the number of 1's at the
267 left side of the network mask. Thus, an iptables mask of 24 is
268 equivalent to 255.255.255.0. A "!" argument before the address
269 specification inverts the sense of the address. The flag --src
270 is an alias for this option. Multiple addresses can be speci‐
271 fied, but this will expand to multiple rules (when adding with
272 -A), or will cause multiple rules to be deleted (with -D).
273 [!] -d, --destination address[/mask][,...]
275 Destination specification. See the description of the -s
276 (source) flag for a detailed description of the syntax. The
277 flag --dst is an alias for this option.
278 -m, --match match
280 Specifies a match to use, that is, an extension module that
281 tests for a specific property. The set of matches make up the
282 condition under which a target is invoked. Matches are evaluated
283 first to last as specified on the command line and work in
284 short-circuit fashion, i.e. if one extension yields false, eval‐
285 uation will stop.
286 -j, --jump target
288 This specifies the target of the rule; i.e., what to do if the
289 packet matches it. The target can be a user-defined chain
290 (other than the one this rule is in), one of the special builtin
291 targets which decide the fate of the packet immediately, or an
292 extension (see EXTENSIONS below). If this option is omitted in
293 a rule (and -g is not used), then matching the rule will have no
294 effect on the packet's fate, but the counters on the rule will
295 be incremented.
296 -g, --goto chain
298 This specifies that the processing should continue in a user
299 specified chain. Unlike the --jump option return will not con‐
300 tinue processing in this chain but instead in the chain that
301 called us via --jump.
302 [!] -i, --in-interface name
304 Name of an interface via which a packet was received (only for
305 packets entering the INPUT, FORWARD and PREROUTING chains).
306 When the "!" argument is used before the interface name, the
307 sense is inverted. If the interface name ends in a "+", then
308 any interface which begins with this name will match. If this
309 option is omitted, any interface name will match.
310 [!] -o, --out-interface name
312 Name of an interface via which a packet is going to be sent (for
313 packets entering the FORWARD, OUTPUT and POSTROUTING chains).
314 When the "!" argument is used before the interface name, the
315 sense is inverted. If the interface name ends in a "+", then
316 any interface which begins with this name will match. If this
317 option is omitted, any interface name will match.
318 [!] -f, --fragment
320 This means that the rule only refers to second and further IPv4
321 fragments of fragmented packets. Since there is no way to tell
322 the source or destination ports of such a packet (or ICMP type),
323 such a packet will not match any rules which specify them. When
324 the "!" argument precedes the "-f" flag, the rule will only
325 match head fragments, or unfragmented packets. This option is
326 IPv4 specific, it is not available in ip6tables.
327 -c, --set-counters packets bytes
329 This enables the administrator to initialize the packet and byte
330 counters of a rule (during INSERT, APPEND, REPLACE operations).
331 OTHER OPTIONS
333 The following additional options can be specified:
334 -v, --verbose
336 Verbose output. This option makes the list command show the
337 interface name, the rule options (if any), and the TOS masks.
338 The packet and byte counters are also listed, with the suffix
339 'K', 'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipli‐
340 ers respectively (but see the -x flag to change this). For
341 appending, insertion, deletion and replacement, this causes
342 detailed information on the rule or rules to be printed. -v may
343 be specified multiple times to possibly emit more detailed debug
344 statements.
345 -w, --wait [seconds]
347 Wait for the xtables lock. To prevent multiple instances of the
348 program from running concurrently, an attempt will be made to
349 obtain an exclusive lock at launch. By default, the program
350 will exit if the lock cannot be obtained. This option will make
351 the program wait (indefinitely or for optional seconds) until
352 the exclusive lock can be obtained.
353 -W, --wait-interval microseconds
355 Interval to wait per each iteration. When running latency sen‐
356 sitive applications, waiting for the xtables lock for extended
357 durations may not be acceptable. This option will make each
358 iteration take the amount of time specified. The default inter‐
359 val is 1 second. This option only works with -w.
360 -n, --numeric
362 Numeric output. IP addresses and port numbers will be printed
363 in numeric format. By default, the program will try to display
364 them as host names, network names, or services (whenever appli‐
365 cable).
366 -x, --exact
368 Expand numbers. Display the exact value of the packet and byte
369 counters, instead of only the rounded number in K's (multiples
370 of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).
371 This option is only relevant for the -L command.
372 --line-numbers
374 When listing rules, add line numbers to the beginning of each
375 rule, corresponding to that rule's position in the chain.
376 --modprobe=command
378 When adding or inserting rules into a chain, use command to load
379 any necessary modules (targets, match extensions, etc).
380
383 iptables uses the /run/xtables.lock file to take an exclusive lock at
384 launch.
385 The XTABLES_LOCKFILE environment variable can be used to override the
387 default setting.
388
391 iptables can use extended packet matching and target modules. A list
392 of these is available in the iptables-extensions(8) manpage.
393
395 Various error messages are printed to standard error. The exit code is
396 0 for correct functioning. Errors which appear to be caused by invalid
397 or abused command line parameters cause an exit code of 2, and other
398 errors cause an exit code of 1.
399
401 Bugs? What's this? ;-) Well, you might want to have a look at
402 http://bugzilla.netfilter.org/
403
405 This iptables is very similar to ipchains by Rusty Russell. The main
406 difference is that the chains INPUT and OUTPUT are only traversed for
407 packets coming into the local host and originating from the local host
408 respectively. Hence every packet only passes through one of the three
409 chains (except loopback traffic, which involves both INPUT and OUTPUT
410 chains); previously a forwarded packet would pass through all three.
411 The other main difference is that -i refers to the input interface; -o
413 refers to the output interface, and both are available for packets
414 entering the FORWARD chain.
415 The various forms of NAT have been separated out; iptables is a pure
417 packet filter when using the default `filter' table, with optional
418 extension modules. This should simplify much of the previous confusion
419 over the combination of IP masquerading and packet filtering seen pre‐
420 viously. So the following options are handled differently:
421 -j MASQ
422 -M -S
423 -M -L
424 There are several other changes in iptables.
425
427 iptables-apply(8), iptables-save(8), iptables-restore(8), ipta‐
428 bles-extensions(8),
429 The packet-filtering-HOWTO details iptables usage for packet filtering,
431 the NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the
432 extensions that are not in the standard distribution, and the netfil‐
433 ter-hacking-HOWTO details the netfilter internals.
434 See http://www.netfilter.org/.
435
437 Rusty Russell originally wrote iptables, in early consultation with
438 Michael Neuling.
439 Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic
441 packet selection framework in iptables, then wrote the mangle table,
442 the owner match, the mark stuff, and ran around doing cool stuff every‐
443 where.
444 James Morris wrote the TOS target, and tos match.
446 Jozsef Kadlecsik wrote the REJECT target.
448 Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as
450 well as the TTL, DSCP, ECN matches and targets.
451 The Netfilter Core Team is: Jozsef Kadlecsik, Pablo Neira Ayuso, Eric
453 Leblond, Florian Westphal and Arturo Borrero Gonzalez. Emeritus Core
454 Team members are: Marc Boucher, Martin Josefsson, Yasuyuki Kozakai,
455 James Morris, Harald Welte and Rusty Russell.
456 Man page originally written by Herve Eychenne <rv@wallfire.org>.
458
460 This manual page applies to iptables/ip6tables 1.8.5.
461iptables 1.8.5 IPTABLES(8)